owasp-amass/amass · warning

wildcard detected

Error message

wildcard detected

What it means

In PerformQuery (engine/plugins/support/resolvers.go), after a successful DNS response the result is fed to wildcardDetected; if the wildcard detector determines the answer came from a DNS wildcard (i.e. the name does not genuinely exist and the resolver synthesized the record), the function returns errors.New("wildcard detected"). This protects enumeration results from wildcard-generated noise that would otherwise produce thousands of fake assets.

Source

Thrown at engine/plugins/support/resolvers.go:105

	{"81.218.119.11", 1},   // GreenTeamDNS Primary
	{"209.88.198.133", 1},  // GreenTeamDNS Secondary
	{"37.235.1.177", 1},    // FreeDNS
	{"38.132.106.139", 1},  // CyberGhost
}

var trusted *pool.Pool
var detector *wildcards.Detector

func PerformQuery(ctx context.Context, name string, qtype uint16) ([]dns.RR, error) {
	for i := 1; i <= 10; i++ {
		msg := utils.QueryMsg(name, qtype)
		if qtype == dns.TypePTR {
			msg = utils.ReverseMsg(name)
		}

		if resp, err := dnsQuery(ctx, msg, trusted); err == nil && resp != nil {
			if wildcardDetected(ctx, resp, detector) {
				return nil, errors.New("wildcard detected")
			}
			if len(resp.Answer) > 0 {
				if rr := utils.AnswersByType(resp, qtype); len(rr) > 0 {
					return rr, nil
				}
			}
		} else if err == ErrNameDoesNotExist || err == ErrNoRecordOfThisType {
			return nil, err
		}
	}
	return nil, ErrFailedMaxDNSAttempts
}

func wildcardDetected(ctx context.Context, resp *dns.Msg, r *wildcards.Detector) bool {
	name := strings.ToLower(utils.RemoveLastDot(resp.Question[0].Name))

	if dom, err := publicsuffix.EffectiveTLDPlusOne(name); err == nil && dom != "" {
		return r.WildcardDetected(ctx, resp, dom)

View on GitHub (pinned to 79299dce87)

Solutions

1. Discard the name as a wildcard artifact — do not add it as a discovered asset.
2. Check the parent zone for wildcard records (dig 'random123.<domain>') to confirm.
3. If it is a false positive, the wildcard detector baseline may be stale; refresh detection data and retry.
4. Handle the returned error distinctly (it is a plain error, match on message or wrap detection in your own check) before generic error handling.

Example fix

// before
rr, err := support.PerformQuery(ctx, name, dns.TypeA)
if err != nil {
    return err
}
// after
rr, err := support.PerformQuery(ctx, name, dns.TypeA)
if err != nil {
    if strings.Contains(err.Error(), "wildcard detected") {
        log.Info("wildcard artifact, skipping", "name", name)
        return nil
    }
    return err
}

// Probe for a wildcard before enumerating
rr, err := support.PerformQuery(ctx, fmt.Sprintf("%s.%s", randomLabel(), domain), dns.TypeA)
hasWildcard := err == nil && len(rr) > 0

rr, err := support.PerformQuery(ctx, name, dns.TypeA)
if err != nil && strings.Contains(err.Error(), "wildcard detected") {
    return nil // discard wildcard artifact
}

When it happens

Trigger: Calling support.PerformQuery for a name whose response matches the wildcard fingerprint collected by the wildcard detector (e.g. the zone has a *.<domain> wildcard record and the queried subdomain never existed).

Common situations: Enumerating subdomains of zones configured with DNS wildcards (common with parking/CDN setups); cloud providers returning wildcard answers for any subdomain; re-testing previously flagged wildcard responses after zone reconfiguration.

Related errors

• no resolver keys were found in the resolvers section
• brute forcing cannot be performed without DNS resolution
• active enumeration cannot be performed without DNS resolutio
• no valid resolvers were found
• name does not exist

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/089a5168bc5c18cf. Report an issue: GitHub.